Cosmo 1.0.0Beta6 allows attackers to execute arbitrary PHP code via the Database Prefix field on the Database Info screen of install.php.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-10429.json"